Validation

formsub checks fields in the browser before it calls your server. Failed checks show inline errors and skip fetch.

Not a security boundary

Anyone can disable JavaScript or POST to your URL directly. Re-validate everything on the server. See Security.

Rules

Rule	When it runs	Message
Required	Element has required	Localized “This field is required”
Email	type="email"	Localized “Invalid email address”
Math captcha	name="numb_captcha"	“Invalid captcha” (English only today)

Required and email copy come from Internationalization.

When it runs

On submit — every field is checked before fetch.

While typing — each input, select, and textarea is re-checked on keyup, change, and blur. The error disappears as soon as the field is valid.

Required fields

Type	Valid when
checkbox / radio	checked
other inputs	non-empty value

Email fields

type="email" is checked against a basic pattern. An optional empty email field passes.

Math captcha

A lightweight bot deterrent — not real protection. Operands live in hidden fields, so a scraper can read the answer.

<input name="numb_captcha" type="text" required autocomplete="off" />

On init, formsub picks two numbers from 1–10, sets a placeholder like 4 + 6 = ?, and adds hidden num1 / num2. The typed answer must equal their sum.

For actual bot resistance, use Google reCAPTCHA v3 and verify the token on the server.

Server field errors

Your API can return per-field messages. formsub places them next to matching names. See Server responses.